BUG: unable to handle page fault for address: ffffdc0000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100026067 P4D 100026067 PUD 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc1-syzkaller-00028-g4dce3b375179 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline] RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443 Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806 RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000 RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732 RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8 R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0 FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: rb_erase_cached include/linux/rbtree.h:126 [inline] __dequeue_entity kernel/sched/fair.c:634 [inline] dequeue_entity kernel/sched/fair.c:4535 [inline] dequeue_task_fair+0x24e/0x16a0 kernel/sched/fair.c:5835 detach_task kernel/sched/fair.c:7980 [inline] detach_tasks kernel/sched/fair.c:8118 [inline] load_balance+0xe4b/0x2be0 kernel/sched/fair.c:10164 rebalance_domains+0x65a/0xc30 kernel/sched/fair.c:10561 __do_softirq+0x1c0/0x9a9 kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x113/0x170 kernel/softirq.c:650 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1106 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline] RIP: 0010:acpi_safe_halt+0x6f/0xb0 drivers/acpi/processor_idle.c:113 Code: fb 84 db 74 06 5b e9 50 61 50 fb e8 4b 61 50 fb e8 36 ce 56 fb 66 90 e8 3f 61 50 fb 0f 00 2d a8 72 76 00 e8 33 61 50 fb fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 fe 5d 50 fb 48 85 db RSP: 0000:ffffc9000010fd20 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff8881002d5580 RSI: ffffffff85f5a7bd RDI: 0000000000000000 RBP: ffff888109ac1064 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: 0000000000000001 R14: ffff888109ac1000 R15: ffff88810c971004 acpi_idle_do_entry drivers/acpi/processor_idle.c:555 [inline] acpi_idle_enter+0x524/0x6a0 drivers/acpi/processor_idle.c:692 cpuidle_enter_state+0x1ab/0xd30 drivers/cpuidle/cpuidle.c:239 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:356 call_cpuidle kernel/sched/idle.c:155 [inline] cpuidle_idle_call kernel/sched/idle.c:236 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:303 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262 secondary_startup_64_no_verify+0xce/0xdb Modules linked in: CR2: ffffdc0000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:rb_set_parent_color include/linux/rbtree_augmented.h:165 [inline] RIP: 0010:__rb_erase_augmented include/linux/rbtree_augmented.h:286 [inline] RIP: 0010:rb_erase+0x21a/0x1210 lib/rbtree.c:443 Code: ea 03 80 3c 02 00 0f 85 b8 0f 00 00 49 89 5e 08 48 85 c9 74 4f 48 89 ca 48 83 cd 01 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 a2 0f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 RSP: 0000:ffffc90000178bb0 EFLAGS: 00010806 RAX: dffffc0000000000 RBX: ffff88810e690090 RCX: ffff000000000000 RDX: 1fffe00000000000 RSI: ffff88810e690090 RDI: 1ffff11021ccc732 RBP: ffff88810e693991 R08: 0000000000000000 R09: ffff8881f6837bf8 R10: ffff8881f6837cc0 R11: 0000000000000001 R12: 0000000000000001 R13: ffff88810e445610 R14: 0000000000000000 R15: ffff8881f6837bf0 FS: 0000000000000000(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffdc0000000000 CR3: 0000000007825000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 03 80 3c 02 00 0f add 0xf00023c(%rax),%eax 6: 85 b8 0f 00 00 49 test %edi,0x4900000f(%rax) c: 89 5e 08 mov %ebx,0x8(%rsi) f: 48 85 c9 test %rcx,%rcx 12: 74 4f je 0x63 14: 48 89 ca mov %rcx,%rdx 17: 48 83 cd 01 or $0x1,%rbp 1b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 22: fc ff df 25: 48 c1 ea 03 shr $0x3,%rdx * 29: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2d: 0f 85 a2 0f 00 00 jne 0xfd5 33: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 3a: fc ff df 3d: 48 rex.W 3e: 89 .byte 0x89